Green tests missed production faults

Finding

The worst faults of 2026 passed locally and only showed on the live system: BUG-0003, BUG-0005, BUG-0006 and BUG-0007. Each depended on something the emulator or tests did not reproduce.

Proof

• An emulator-only claim made a broken rule pass (d13eee15).
• Android sends no Origin, and tests did not (712be3d2).
• The real SDK sends undefined as null (1c68c7c9).
• The CDN and the order of deploy steps exist only in production (f0857827).

Verified by

Commit messages and the tests they added.

What it means

Do not take a green local run as proof for auth, App Check, payments or deploys. Run the live checks: pnpm --filter website e2e:production (infrastructure), pnpm check:api, and scripts/check-cdn-fresh.mjs.